Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ca0e8e0b184b057df3b61b25d65e8cdbd94ec2a2d969ddafa739c5a57fb2ca5e

  • Size

    5.5MB

  • Sample

    240630-rw6n2ssfrk

  • MD5

    99ac5ef0e40e7da63631cc9d7c0e53f6

  • SHA1

    e37988c4a8744069f301df029a9af087b70e3ff0

  • SHA256

    ca0e8e0b184b057df3b61b25d65e8cdbd94ec2a2d969ddafa739c5a57fb2ca5e

  • SHA512

    63269792a76bbe00549d4aa6e402df1926f9e04df57b300ef5eb0954fa02d4bd4791e67ff6de255bd71e4753ddd6077e0e3bbff760395bb4434b5b3f01b89df2

  • SSDEEP

    98304:Cj9Y/YwIoxtkZmvcZWxohqg4m/E02yk00SJu7HsKxw2dYu+U2ZVOvQxy:g9YwzokgDoX32vbouBr+U2OvQQ

Score
10/10
socks5systemzbotnetdiscovery

Malware Config

Targets

    • Target

      ca0e8e0b184b057df3b61b25d65e8cdbd94ec2a2d969ddafa739c5a57fb2ca5e

    • Size

      5.5MB

    • MD5

      99ac5ef0e40e7da63631cc9d7c0e53f6

    • SHA1

      e37988c4a8744069f301df029a9af087b70e3ff0

    • SHA256

      ca0e8e0b184b057df3b61b25d65e8cdbd94ec2a2d969ddafa739c5a57fb2ca5e

    • SHA512

      63269792a76bbe00549d4aa6e402df1926f9e04df57b300ef5eb0954fa02d4bd4791e67ff6de255bd71e4753ddd6077e0e3bbff760395bb4434b5b3f01b89df2

    • SSDEEP

      98304:Cj9Y/YwIoxtkZmvcZWxohqg4m/E02yk00SJu7HsKxw2dYu+U2ZVOvQxy:g9YwzokgDoX32vbouBr+U2OvQQ

    Score
    10/10
    socks5systemzbotnetdiscovery

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

      botnetsocks5systemz

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks